Connect S3 to webQsee, the quick way

This is the simplified S3 setup. Every webQsee user on your team uses the same AWS Access Key, sharing one IAM user, one policy and one bucket without per-user folder isolation. That trade-off is fine when:

• You are a solo user, OR
• Your team is small and trusted, AND
• You don't need AWS-level enforcement of "user A cannot read user B's private folder".

If you later need per-user isolation, you can migrate without losing any data, see Migrate from simplified to multi-user. For the full multi-user setup right away, see Connect Amazon S3 (multi-user / RBAC).

1. Create an AWS account

1. Sign up for AWS

   Go to aws.amazon.com/free, click Create an AWS Account, fill out the form (email, account name, payment, SMS verification) and pick the Basic Support, Free plan.

   Sanity check: You see "Congratulations / Your AWS account is ready" and can sign in to the AWS Management Console as the root user.

2. Pick a region

   In the top-right region selector pick a region close to your team (e.g. eu-central-1 for Frankfurt, us-east-1 for Virginia). Write the region code down, you'll need it later.

   Sanity check: The region indicator in the top-right shows your chosen region.

2. Create the webqsee-admin policy

One single policy that grants full read/write on the bucket's /shared/, /protected/ and /private/ prefixes.

1. Open IAM → Policies → Create policy

   Console search bar → IAM. Sidebar → Policies → Create policy. Switch to the JSON tab.

   Sanity check: The empty JSON editor is open.

2. Paste the policy JSON

   This policy assumes the bucket will be called webqsee. If you'll use a different name, replace every webqsee in the ARNs below first.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "ListBucketScoped",
         "Effect": "Allow",
         "Action": [
           "s3:ListBucket",
           "s3:GetBucketLocation",
           "s3:GetBucketCors"
         ],
         "Resource": "arn:aws:s3:::webqsee",
         "Condition": {
           "StringLike": {
             "s3:prefix": [
               "shared/*",
               "shared/",
               "protected/*",
               "protected/",
               "private/*",
               "private/",
               ""
             ]
           }
         }
       },
       {
         "Sid": "FullObjectAccess",
         "Effect": "Allow",
         "Action": [
           "s3:GetObject",
           "s3:GetObjectTagging",
           "s3:PutObject",
           "s3:PutObjectTagging",
           "s3:DeleteObject",
           "s3:AbortMultipartUpload",
           "s3:ListMultipartUploadParts"
         ],
         "Resource": [
           "arn:aws:s3:::webqsee/shared/*",
           "arn:aws:s3:::webqsee/protected/*",
           "arn:aws:s3:::webqsee/private/*"
         ]
       }
     ]
   }

   Sanity check: No red JSON validation errors. Click Next, the review screen lists S3 actions GetObject, PutObject, DeleteObject, ListBucket on the bucket and its three prefixes.

3. Save as webqsee-admin

   Name: webqsee-admin. Description: "webQsee Cloud Gallery, shared-user full access". Click Create policy.

   Sanity check: The webqsee-admin policy is listed under Customer managed policies.

3. Create the shared IAM user

In the simplified setup, you can either attach the policy directly to the user, or attach it via a group. We recommend a group for forward-compatibility, if you ever migrate to multi-user, the group is already there.

1. Create group webqsee-admin

   IAM → User groups → Create group. Name: webqsee-admin. Attach the webqsee-admin policy. Click Create group.

   Sanity check: The group webqsee-admin appears in the list with "1 attached policy, 0 users".

2. Create the shared user

   IAM → Users → Create user. Username: webqsee-shared. Do not grant console access. Click Next.

   Sanity check: You're on the "Set permissions" step.

3. Add the user to the group

   Choose Add user to group, tick webqsee-admin, click Next, then Create user.

   Sanity check: The new user webqsee-shared appears in the user list with Status: Active and group membership webqsee-admin.

4. Create an access key

   Open the user → Security credentials tab → Create access key → use case Application running outside AWS.

   Sanity check: AWS displays the Access Key ID (starts with AKIA) and the Secret access key, visible exactly once.

5. Store the credentials securely

   Save both values in your team password manager. The secret cannot be recovered. If you lose it, delete and re-create the key.

   Sanity check: Access Key ID and Secret are saved in your password manager and you can read them back without opening AWS again.

4. Create the S3 bucket

1. Open S3 → Create bucket

   Confirm the region (top-right) matches what you chose in step 1.

   Sanity check: You're on the Create bucket form, region matches.

2. Name and configure

   Bucket name: webqsee (must match the ARNs in the policy, if you have to pick a unique name like webqsee-acme, update both the policy ARNs and the webQsee setting). Block all public access: ON. Bucket versioning: Disabled. Default encryption: SSE-S3 (AES-256). Object ownership: ACLs disabled.

   Sanity check: The review summary shows: Public access fully blocked, Versioning Disabled, Encryption SSE-S3.

3. Create the bucket

   Click Create bucket.

   Sanity check: Green toast "Successfully created bucket 'webqsee'" and the bucket appears in your S3 bucket list.

5. Apply CORS

1. Open the bucket Permissions tab

   Click your bucket → Permissions → scroll to Cross-origin resource sharing (CORS) → Edit.

   Sanity check: The CORS JSON editor opens.

2. Paste the CORS configuration

   [
     {
       "AllowedOrigins": [
         "https://view.webqsee.com",
         "https://app.webqsee.com",
         "chrome-extension://*"
       ],
       "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
       "AllowedHeaders": ["*"],
       "ExposeHeaders": ["ETag", "x-amz-request-id", "x-amz-version-id"],
       "MaxAgeSeconds": 3000
     }
   ]

   Click Save changes.

   Sanity check: Green toast "Successfully edited CORS" appears. Reload the page and confirm the JSON persisted.

6. Configure webQsee Cloud Gallery

1. Open Cloud Gallery settings

   webQsee → main window → Gallery tab → Cloud Gallery → Edit Settings.

   Sanity check: The settings panel shows Team-wide and Personal sections.

2. Fill in team-wide settings

   • Storage Type: S3 compatible storage, KEY-Auth
   • Authentication mode: Single shared credentials (simplified)
   • Bucket name: webqsee
   • Connection settings:

     {
       "region": "eu-central-1"
     }

   • Shared Access Key ID and Shared Secret access key: the credentials of webqsee-shared

   Click Save team settings.

   Sanity check: Toast "Team cloud settings saved" appears, and the panel header shows "Cloud Storage connected ✓".

3. Verify with a test upload

   Take any screenshot, right-click it in the local gallery and choose Upload to Cloud → Shared. Watch for the green "Uploaded" indicator on the thumbnail.

   Sanity check: The screenshot now also appears under the Cloud Gallery's Shared tab. Refreshing the AWS S3 console shows a new object under shared/.

Troubleshooting

• CORS error in console: re-apply step 5 and make sure the JSON saved (some browsers cache the old CORS pre-flight; a hard refresh helps).
• 403 Forbidden on PUT: the policy ARN does not match the actual bucket name. Edit the webqsee-admin policy and ensure every ARN uses your bucket name exactly.
• SignatureDoesNotMatch: secret was mis-copied. Generate a fresh key and paste it carefully (watch for leading/trailing whitespace).
• NoSuchBucket: bucket name typo in webQsee, or the bucket is in a different region than the region field in the Connection settings JSON.
• "This setup mode is not allowed for teams > N members": webQsee blocks the simplified mode for teams above a certain size. Switch to multi-user using this migration guide.
• RequestTimeTooSkewed: system clock is more than 15 minutes off. Re-sync the OS clock.

Related tutorials